Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

PowerShell: Error provisoning a user for Office Communicator 2007 R2 (Using SET-QADUser)

Posted on 2011-02-21
8
Medium Priority
?
1,623 Views
Last Modified: 2013-11-29
I'm getting the following error when I attempt to use Quest SET-QADUser to provision a user for OCS 2007 R2 support.

I get that the SET-QADUser is in the example below is modifying the user account attributes directly, but I'm confused as to why the command is failing.

The server I'm pointing to is the Office Communicator 2007 R2 server...

Set-QADUser : A constraint violation occurred.

At \\<network path erased>\NewUserCreationV1_1.ps1:530 char:13

+     set-qaduser <<<<  -identity $strSamAccountName -oa @{'msRTCSIP-UserEnabled'=$true;'msRTCSIP-PrimaryHomeServer'='CN=OCServer1,CN=Live Communicator,CN=Member Servers,CN=Servers,DC=humpty,DC=dumpty,DC=com';'msRTCSIP-PrimaryUserAddress'=("sip:" + $strMailAddress );'msRTCSIP-OptionFlags'=256;'msRTCSIP-InternetAccessEnabled'=$true}

    + CategoryInfo          : NotSpecified: (:) [Set-QADUser], DirectoryServicesCOMException

    + FullyQualifiedErrorId : System.DirectoryServices.DirectoryServicesCOMException,Quest.Act
   iveRoles.ArsPowerShellSnapIn.Powershell.Cmdlets.SetUserCmdlet


Any thoughts?

I don't see any options on Experts Exchange for OCS 2007 (or any OCS / Lync platform for that matter), so I'm placing this in PowerShell and AD.

GB
0
Comment
Question by:gerhardub
  • 4
  • 3
7 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34942704

They both sit until LCS (Live Communications Server), which is a tad out of date these days.

Anyway, I think this is the problem:

msRTCSIP-PrimaryHomeServer

I believe this should be a reference to the Pool under the Configuration Naming Context, not the server itself in the Domain context.

Chris
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34942719

And just for reference, the topic area path is:

OS / Microsoft OS / MS Server OS / Microsoft LCS

Chris
0
 
LVL 1

Author Comment

by:gerhardub
ID: 34943296
You rock... searching just did not find OCS, Lync, or LCS...

A pool eh?  Humph... I just not really familiar with LCS to know what to look for in AD... (Assuming I look in AD for the pool?  ...or is it the container were the OCS server resides?, etc.)

GB
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 34943412

Can you copy it from someone who is already activated on the system?

I forget exactly what it looks like for OCS (upgraded ours to Lync), but it will be named after the server for Standard Edition. And it'll be under this if I remember correctly:

CN=Pools,CN=RTC Service,CN=Services,CN=Configuration,DC=domain,DC=com

If not that, you might check that proxyAddresses already contains the SIP address, not sure if it validates that at all, or if it just figures itself out.

Upgrade to Lync, Enable-CsUser is easier :)

Chris
0
 
LVL 1

Author Comment

by:gerhardub
ID: 34944299
Ok,

So this is what I needed to do to get it to work, and it did work:

set-qaduser -identity $strSamAccountName -oa @{'msRTCSIP-UserEnabled'=$true;'msRTCSIP-primaryHomeServer'='CN=LC Services,CN=Microsoft,CN=<LCS Server>,CN=Pools,CN=RTC Service,CN=Microsoft,CN=System,DC=<company>,DC=com';'msRTCSIP-PrimaryUserAddress'=("sip:" + $strMailAddress );'msRTCSIP-OptionFlags'=256;'msRTCSIP-InternetAccessEnabled'=$true}

What I find confusing is that none of the contructs are visible in AD as OUs.  E.g. pools.RTC Service.Microsoft.System... etc.

Using the format above causes everything to work without issue... the only configuration difference I need to fix is that the "Allow Remote Access" attribute is set to $true.

But the code about will provision an OCS account and it does work!

GB
1
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34944315

> What I find confusing is that none of the contructs are visible in AD as OUs.  E.g. pools.RTC Service.Microsoft.System... etc.

They are, just not in AD Users and Computers. If you fire up ADSI Edit you can access the Configuration naming context, it's an entirely separate partition of AD.

Chris
0
 
LVL 1

Author Comment

by:gerhardub
ID: 34944709
Roger... thanks!
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are times when we need to generate a report on the inbox rules, where users have set up forwarding externally in their mailbox. In this article, I will be sharing a script I wrote to generate the report in CSV format.
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question